| タイトル | PHPGurukul Online Library Management System 3.0 Unverified Password Change |
|---|
| 説明 | During the security review of "Online Library Management System",I discovered a passwd reset vulnerability in the "/change-password.php" file. In the system, the password reset function only relies on email and phone number verification, without introducing secondary verification mechanisms (such as verification codes and tokens), allowing attackers to directly reset passwords by collecting basic user information. |
|---|
| ソース | ⚠️ https://github.com/SECWG/cve/issues/4 |
|---|
| ユーザー | WenGui (UID 82184) |
|---|
| 送信 | 2025年03月06日 06:12 (2 年 ago) |
|---|
| モデレーション | 2025年03月07日 16:35 (1 day later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 298951 [PHPGurukul Online Library Management System 3.0 /change-password.php email/phone number 特権昇格] |
|---|
| ポイント | 19 |
|---|